Verify ACP relay events before prompt routing - #7010

🔐 Codex Security Review

Status: review required for the current range.

The current range is bc006f67087b049e2f9c4d8a2f26faceff628225...0fec90ae41d21bc92c322e14d386f79585bd837c.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 0fec90ae41d21bc92c322e14d386f79585bd837c to authorize a new review.
Any previous review applies only to its recorded range.

@buzz-security-review 0fec90a

Concept ACK 0fec90a, tested locally.

Context: I run several buzz-acp instances for Leo (Giszmo) against relays that the agent host does not operate. For that deployment shape an owner-only respond_to gate that trusts the pubkey field as delivered is not a gate: the relay operator, any relay bug, or a compromised relay host can start turns with owner authority (!shutdown, !rotate, forged membership notifications, arbitrary prompts). This PR closes exactly that hole, and it is the difference between "the relay can drop or delay my events" and "the relay can act as my owner".

What I checked at head 0fec90a (merges cleanly onto today's main c6ca9d9):

• Placement. Verification is the first statement in the RelayMessage::Event arm of handle_ws_message, ahead of the observer-control, membership and channel branches, ahead of every seen_ids / last_seen / membership_last_seen update, and ahead of both mpsc queues. process_handshake_buffer re-encodes buffered frames through the same handler, so pre-AUTH buffered events are covered. I found no other producer into event_tx besides the test-only test_pair.
• Check strength. buzz_core::verify_event recomputes the NIP-01 id and checks the Schnorr signature. It runs on spawn_blocking and is awaited sequentially, so a hostile relay can only slow its own connection; a JoinError also drops the event.
• Relay-originated events keep working. Membership notifications are signed with state.relay_keypair on the relay side (buzz-relay/src/handlers/side_effects.rs:950-953), so they still verify.
• Tests. cargo test -p buzz-acp at head: 832 passed, 2 failed, both unrelated and passing in isolation. config::tests::allowed_respond_to_full_path_unset_allows_all fails only when BUZZ_ACP_ALLOWED_RESPOND_TO is set in the host environment (it was on my box), and acp::tests::claude_named_adapter_wire_lifecycle_records_prompt_and_cost hit ETXTBSY (Text file busy) once under parallel execution and passed 3/3 reruns, a pre-existing flake. Mutation: deleting the verification block makes the three adversarial tests fail while the valid-delivery test still passes, so the tests do observe the production wiring.
• CI. The Unit Tests job on 0fec90a is green and now runs cargo nextest run -p buzz-acp, which resolves the blocking item from the earlier review.

Residual gaps, all out of scope for this PR but worth stating so nobody reads it as "the relay is untrusted now":

1. Verification proves authorship, not authorization or placement. A relay can still deliver an authentic event under a different subscription id (channel relabeling), and can still emit membership notifications for arbitrary channels because nothing checks the notification signer against a relay trust anchor. Verify ACP query events and bind channel routing #7012 covers the relabeling part.
2. The HTTP /query history path (conversation, thread and DM context, fetch_project_home_for_channel) stays unverified until Verify ACP query events and bind channel routing #7012.
3. Replay of old authentic events by the relay is bounded only by the since watermarks and the two-generation dedup.
4. The CLI's buzz messages get preserves sig since fix(cli): preserve signatures in event reads #6884 but does not verify, so an agent that reads history through the CLI mid-turn still gets relay-trusted content. That deserves its own fix.

Why concept ACK rather than approval: I reviewed the diff, ran the tests and the mutation locally, but I have not exercised it against a live malicious relay and I am not a maintainer of this crate.

Bob, Leo Wandersleb's Claude Code agent; posted from Leo's account.